California Biometric Privacy Law: Scope, Compliance, and Penalties

California does not have a single, stand-alone biometric privacy statute like Illinois’ Biometric Information Privacy Act. Instead, biometric information is regulated through a mix of state privacy and data-breach laws, especially the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rules can affect how covered businesses collect, use, disclose, retain, and secure biometric data. Understanding which data and businesses are covered is essential because obligations and potential penalties depend on how the information is handled.

Does California Have a Biometric Privacy Law?

California has no general law that requires every private business to obtain written consent before collecting biometric information. Its main framework is the CCPA and CPRA, which treat certain biometric information as sensitive personal information. California’s data-breach notification law also expressly includes some biometric data in its definition of personal information.

This framework differs from laws such as Illinois BIPA, which imposes specific notice, consent, retention, and disclosure requirements for covered biometric identifiers and provides a private right to sue for certain violations. California’s rules are broader in some respects because the CCPA can cover many types of personal information, but they do not create the same across-the-board biometric consent system.

Other laws may apply depending on the context. For example, health information may be subject to medical privacy laws, and workplace monitoring may raise employment or constitutional privacy concerns. A business should assess the data, purpose, industry, and collection method rather than assume the CCPA is the only relevant rule.

What Counts as Biometric Information in California?

The CCPA defines biometric information broadly as information about a consumer’s physiological, biological, or behavioral characteristics that can be used, alone or with other data, to establish individual identity. Examples can include a person’s fingerprint, face, voice, iris, retina, hand, or palm pattern, as well as certain behavioral characteristics such as gait or keystroke patterns.

Not every image, voice recording, or measurement is automatically sensitive biometric information under the CCPA. A key distinction is purpose: the law classifies biometric information as sensitive personal information when it is processed for the purpose of uniquely identifying a consumer. A photograph used in an ordinary photo gallery, for instance, may present different issues from facial geometry extracted to identify a person at a venue.

California’s breach-notification law uses a related but not identical definition. It covers biometric data generated from measurements of an individual’s unique biological characteristics—such as a fingerprint, retina, or iris scan—when used to authenticate identity. This distinction matters because the CCPA’s privacy duties and the breach law’s notification and lawsuit provisions do not have identical scope.

Which Businesses Must Comply?

The CCPA generally applies to for-profit businesses that do business in California, determine the purposes and means of processing consumers’ personal information, and meet at least one statutory threshold. As of 2026, the revenue threshold is adjusted for inflation and is approximately $26.6 million in annual gross revenue. The other tests generally concern buying, selling, or sharing personal information of at least 100,000 California consumers or households in a year, or deriving at least half of annual revenue from selling or sharing consumers’ personal information.

These tests can apply to businesses outside California if they meet the law’s requirements. A business may also be covered through its relationship with an entity that controls it, is controlled by it, or shares common branding, if the relevant legal conditions are met. Service providers, contractors, and other recipients have defined roles and obligations under the law.

Employee and business-to-business information is no longer generally exempt from the CCPA. Since the exemptions expired, personal information collected in employment and commercial contexts may be covered when the business and information meet the law’s requirements. The law still contains specific exceptions, including certain information governed by other privacy laws, but those exceptions are limited and should not be treated as blanket industry exemptions.

Core CCPA and CPRA Rules for Biometric Data

Covered businesses must provide clear notices about collection, use, retention, and disclosure practices. If a business collects biometric information, its notice at collection should identify the relevant categories of personal information and explain the purposes for which they will be used. Information should not be collected or retained for purposes that are incompatible with what was disclosed, and retention should be limited to what is reasonably necessary and proportionate for disclosed purposes.

Because biometric information processed to identify a person is sensitive personal information, additional rules may apply. Consumers generally have a right to limit a business’s use and disclosure of sensitive personal information to certain permitted purposes, such as providing requested services or ensuring security. The right is not an automatic ban on all use of sensitive data: whether a limitation option is required depends on the business’s uses and disclosures under the law and regulations.

Businesses that sell or share personal information must provide the applicable opt-out rights and honor valid requests. “Sharing” includes certain disclosures for cross-context behavioral advertising, even when no money changes hands. Separate opt-in rules apply to selling or sharing the personal information of consumers under 16: a business must obtain affirmative authorization from the consumer ages 13 to 15, or from a parent or guardian for a child under 13.

Businesses must also support applicable consumer rights, including requests to know, delete, and correct personal information, and to opt out of sale or sharing. They must verify requests appropriately, respond within required timeframes, avoid unlawful discrimination for exercising rights, and provide required methods for submitting requests. A business handling biometric data should ensure its systems can locate and act on that data across relevant databases, vendors, and retention systems.

Practical Compliance Steps

Biometric information is difficult to replace if exposed. A sound compliance program therefore combines privacy-law procedures with strong security and careful product design. These steps can help a business identify and reduce risk:

• Map the data. Identify biometric signals, templates, identifiers, and related information; record where they come from, where they are stored, who receives them, and how long they are kept.
• Document the purpose. State why each biometric feature is needed and whether it is used to identify, authenticate, secure, or personalize a service. Avoid collecting information “just in case.”
• Review notices and choices. Explain biometric collection and use at or before collection, and provide required access, deletion, correction, opt-out, and sensitive-information controls.
• Set retention and deletion rules. Define retention periods based on business need, legal requirements, and disclosed purposes. Ensure deletion reaches vendors and backups when legally and technically required.
• Secure the information. Use access controls, encryption where appropriate, secure storage, monitoring, and incident-response procedures. Limit employee and vendor access to what is necessary.
• Manage vendors. Use contracts that specify permitted purposes, security measures, assistance with consumer requests, retention limits, and restrictions on selling or using data outside the contracted service.
• Assess higher-risk processing. Review new identification or surveillance features before launch, including risks of misidentification, discrimination, unexpected secondary use, and collection from people who did not expect it.

These measures do not replace legal advice or guarantee compliance. They provide a practical foundation for applying California’s requirements to a biometric system and for demonstrating that privacy risks were considered before deployment.

Penalties and Enforcement

The California Privacy Protection Agency (CPPA) and the California Attorney General can enforce the CCPA. Administrative or civil penalties can generally reach $2,500 per violation, or $7,500 per intentional violation and certain violations involving the personal information of consumers under 16. The precise amount depends on the facts, applicable procedures, and enforcement authority. A violation involving biometric information is not automatically subject to the higher amount; the relevant legal standard must be met.

California does not provide a general private right to sue for every CCPA violation. Consumers may, however, bring a limited private action after certain data breaches involving specified categories of unencrypted or unredacted personal information, if the business failed to maintain reasonable security procedures and practices. The breach statute includes biometric data used to authenticate identity within its definition of personal information.

For a qualifying breach claim, statutory damages generally range from $100 to $750 per consumer per incident, or actual damages, whichever is greater, subject to the statute and court findings. The law requires written notice to the business before filing and gives the business an opportunity to address the alleged security failure in the circumstances specified by the statute. This notice-and-cure process is not a general cure period for all CCPA violations.

California’s breach-notification law may separately require notice to affected residents when specified personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person. Whether notice is required depends on the information involved, whether it was encrypted or redacted, and the facts of the incident. A business should promptly involve legal, security, and incident-response personnel after a suspected exposure.

How California’s Rules Differ From BIPA

Businesses comparing California law with Illinois BIPA should not treat them as interchangeable. BIPA has specific requirements for covered biometric identifiers and information, including written notice and release obligations in relevant circumstances, a publicly available retention policy, restrictions on disclosure and sale, and a private right of action. California’s CCPA instead regulates biometric data within a broad consumer privacy framework and limits private lawsuits primarily to certain security breaches.

That difference does not make California’s requirements optional. A company operating in multiple states may need to comply with California’s notice, rights, opt-out, sensitive-information, retention, and security rules while separately meeting BIPA and other state laws. A single biometric product can trigger different requirements depending on the consumer’s location, the data collected, and the system’s purpose.

Key Questions for Businesses

California’s biometric privacy framework is best understood as a set of overlapping obligations, not a single consent rule. Businesses should determine whether they are covered, identify when biometric information is used to establish identity, disclose practices accurately, honor consumer rights, limit retention, and protect the data. Because statutory thresholds, regulations, and enforcement guidance can change, organizations should verify current requirements with qualified counsel before launching or materially changing biometric processing.